Policy 4.3: Confidentiality & Privacy Compliance (FERPA/HIPAA)  

I. Policy Statement

The School of Nursing (SoN) requires all students to protect the confidentiality and privacy of information in compliance with federal, state, and University regulations.

• FERPA protects the privacy of student educational records.
• HIPAA protects the privacy and security of patient health information.

Students are responsible for adhering to all applicable privacy laws and University policies. Unauthorized access, use, or disclosure of confidential or private information is a serious violation and may result in action under School or University policy, up to and including dismissal.

II. Applicability

This policy applies to all SoN students across programs and encompasses all settings, including classrooms, simulation, clinical, research, community-based, and administrative interactions.

The duty to protect confidential and private information continues after the relevant course, clinical placement, or program ends, and applies to information learned at any point during enrollment.

III. Requirements

A. FERPA Compliance

• Student educational records are confidential.
• Students may not access or disclose another student’s information without authorization.
• Students are expected to understand their FERPA rights and responsibilities as outlined by the University of Washington Registrar’s Office (e.g., rights to review and amend records, consent to disclosures, and restrict directory information).

B. HIPAA Compliance

• Students must protect patient information encountered in clinical, practicum, community, or research activities.
• Students must access only the minimum patient information necessary to perform an assigned clinical, academic, or research task. Accessing the record of a patient not under the student’s care, or accessing more of a record than the task requires, violates this policy whether or not the information is further disclosed.
• Clinical students complete HIPAA training as part of compliance requirements prior to beginning clinical activities.
• Other students may be required to complete HIPAA training if specified by a community, project, or program site.
• Written work, presentations, and discussions must exclude identifiable patient information, applying the identifiers listed in the HIPAA Safe Harbor standard at 45 CFR 164.514(b)(2). Removing those identifiers permits material to be used in coursework. It does not permit the material to be posted publicly or shared on social media, which UW School of Nursing Policy 4.4: Professional Communication & Technology Standards prohibits regardless of de-identification.

C. Reporting and Accountability

• Clinical or practicum settings: A suspected or actual breach of confidentiality involving patient information in a clinical or practicum setting is a reportable clinical incident. The student notifies the clinical faculty or preceptor immediately. Faculty then report under UW School of Nursing Policy 3.4: Clinical Incident & Exposure Reporting. Breaches involving patient information at a clinical site are also reported through that site’s own privacy reporting process.
• Research settings: A suspected or actual breach involving human subjects data is reported to the principal investigator, who reports under the requirements of the UW Human Subjects Division. See UW School of Nursing Policy 4.5: Research Integrity and Authorship.
• All other settings: A suspected or actual breach arising in a course or administrative context is reported immediately to course faculty. If no course faculty member is involved, the incident is reported to the Associate Dean for Student and Academic Affairs (ADAA; sonadaa@uw.edu), who determines any additional reporting requirements.
• Breaches are reviewed under UW School of Nursing Policy 4.1: Essential Qualifications & Behaviors, UW School of Nursing Policy 3.4, and, where applicable, referred to University conduct or compliance offices.

IV. Roles & Responsibilities Summary

Last updated: September 2026